- Can I install javer/sp-bundle in a Laravel application?
- No, not as a Laravel package. It is a Symfony bundle that ships a Symfony Bundle class, a DependencyInjection configuration tree, and container-compiled service wiring, none of which Laravel's service container or provider model can use. You would need to port the underlying SAML2 service-provider logic into a Laravel-native wrapper.
- What does javer/sp-bundle actually do?
- It is a SAML2 service-provider Symfony bundle based on LightSAML. It provides Symfony bundle wiring and package setup helpers for service-provider configuration and resources. The reusable asset is almost certainly the SAML2 protocol logic, not the Symfony bundle glue.
- Does javer/sp-bundle support Laravel 10 or Laravel 11?
- No. It has no Laravel service provider, facade, config publishing, or Composer auto-discovery path that Laravel will honor. Laravel version support is not applicable because the package targets Symfony's dependency-injection and HTTP kernel layers. Any Laravel use would be a fork or port, not a normal install.
- How do I install javer/sp-bundle?
- Installation is via Composer into a Symfony application, followed by registering the bundle in the Symfony kernel and configuring its dependency-injection tree. There is no Laravel installation path because Laravel does not understand Symfony bundle registration or container compilation. For Laravel, treat the repository as reference code for SAML2 SP behavior and build a Laravel wrapper.
- Is javer/sp-bundle production-ready for SAML2 SSO?
- Adoption signal is effectively zero, with 1 star and 0 dependents, plus a single 2024-01-09 release. There is no public issue history or inherited security review to rely on. SAML is security-critical, so production use would require your own audit, transitive Composer audit, SCA scan, and ongoing maintenance commitment.
- What SAML2 library does javer/sp-bundle use?
- The package name and LightSAML description suggest it wraps the LightSAML library family, likely lightsaml/lightsaml-core or similar. You must verify the exact pinned version and whether that library still receives security patches. The XML DSig layer also needs a full CVE and dependency audit before any spike concludes.
- Does javer/sp-bundle support Single Logout, encrypted assertions, or signed AuthnRequests?
- The provided context does not confirm these features; it only identifies the package as a SAML2 SP Symfony bundle. You would need to inspect the code or ask the maintainer about SLO, encrypted assertions, signed AuthnRequests, and multi-IdP metadata refresh. Do not assume basic SP-initiated SSO covers your requirements.
- How does javer/sp-bundle handle AuthnRequest IDs for horizontal scaling?
- The context does not specify whether AuthnRequest IDs are persisted in session, file, or cache. That detail determines whether the SP can scale horizontally behind a load balancer. You must verify persistence behavior before designing a multi-node deployment.
- What are alternatives to javer/sp-bundle for Laravel SAML2?
- Prefer a managed IdP broker such as Okta, Entra ID, Auth0, or Keycloak, terminating SAML at the broker and integrating Laravel over OIDC with a maintained library. That removes XML DSig and canonicalization from your threat surface and converts certificate rotation into a vendor-run ceremony. If you need in-app SAML, choose an actively maintained Laravel SAML package rather than porting this Symfony bundle.
- Is javer/sp-bundle maintained and safe to depend on?
- It has a bus factor of one and a quiet repository with a single release. Symfony dependency-injection and configuration APIs drift across 4.x through 7.x, and PHP 8.3 and 8.4 compatibility is unverified. You would inherit IdP certificate-rollover bugs, XML canonicalization edge cases, and security fixes as the sole maintainer of a critical codepath.